Extracted

• • Target
    01b5b716cf9b9802b46635638d889a85_JaffaCakes118
  • Size 13.9MB
  • SHA256 fdbbaf0c8b94aee61088e99700484f54fdf62ce20954195c4b92fde85e732c57
  • MD5 01b5b716cf9b9802b46635638d889a85
  • SHA1 782283c2d14476450c01cf334894c8b013879fc3
  • SHA512 a1adca70a104df4dee66443817d732a0e1ed0d497c833e8b7f7428fad332166946e981197740910c723bb11026aee24737e9a4b8674f9698f99905c1f67f3abc
  • SSDEEP 98304:dEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE3:
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2